RoFL: Robustness of Secure Federated Learning

Abstract

Federated Learning is an emerging decentralized machine learning paradigm that allows a large number of clients to train a joint model without the need to share their private data. Participants instead only share ephemeral updates necessary to train the model. To ensure the confidentiality of the client updates, Federated Learning systems employ secure aggregation; clients encrypt their gradient updates, and only the aggregated model is revealed to the server. Achieving this level of data protection, however, presents new challenges to the robustness of Federated Learning, i.e., the ability to tolerate failures and attacks. Unfortunately, in this setting, a malicious client can now easily exert influence on the model behavior without being detected. As Federated Learning is being deployed in practice in a range of sensitive applications, its robustness is growing in importance. In this paper, we take a step towards understanding and improving the robustness of secure Federated Learning. We start this paper with a systematic study that evaluates and analyzes existing attack vectors and discusses potential defenses and assesses their effectiveness. We then present RoFL, a secure Federated Learning system that improves robustness against malicious clients through input checks on the encrypted model updates. RoFL extends Federated Learning's secure aggregation protocol to allow expressing a variety of properties and constraints on model updates using zero-knowledge proofs. To enable RoFL to scale to typical Federated Learning settings, we introduce several ML and cryptographic optimizations specific to Federated Learning. We implement and evaluate a prototype of RoFL and show that realistic ML models can be trained in a reasonable time while improving robustness.

Byzantine-Resilient Secure Federated Learning on Low-Bandwidth Networks

“…Communication efficiency is achieved by sending random vectors (shares) to mask users' local model in small size, but, initial studies [14], [15], [16], [17], [18], [19], [20], [21], [22], [23] do not assume that Byzantine users inject contaminated shares or contaminated aggregated shares. RoFL [30] introduces a mechanism of checking final aggregation results using commitments to users' local models. The server aggregates all the users' commitments and compares the resulting commitment with the aggregation result of all local models.…”

Privacy-Preserving Aggregation in Federated Learning: A Survey

“…For example, in [102], differentially private noises are added to users' models to guarantee privacy during weighted averaging in aggregation. TEE in [74], pseudo-random functions in [103], MAC-like technique in [104], homomorphic hash in [106], zero-knowledge proofs in [107], and commitment scheme in [105] are deployed to guarantee that the server correctly aggregates the sum from FL users. Model Quantization;TEE [75] [76] [78] Model Quantization [79] Coding approach [77] Model spasification [80] [81] Determined by the size of submodels Submodel aggregation [82] So far, we have reviewed masking-based aggregation protocols to protect users' model privacy and global model privacy.…”

FedComm: Federated Learning as a Medium for Covert Communication

“…Because this class of attacks is particularly disruptive, during the years, many mitigation techniques [13,16,49,85] have been proposed. Burkhalt et al [11] presented a systematic study to assess the robustness of FL, extending FL's secure aggregation technique proposed in [10]. Burkhalt et al [11] integrated a variety of properties and constraints on model updates using zero-knowledge proof, which is shown to improve FL's resilience against malicious participants who attempt to backdoor the learned model.…”